@plainconceptsplatform/workflows 1.6.47 → 1.6.48

package/loops/actions/identify-gate-subject/action.yml

@@ -144,7 +144,11 @@ runs:
         if [ -n "$ci_run_id" ]; then
           run_sha="$(gh api "repos/$REPO/actions/runs/$ci_run_id" --jq '.head_sha' 2>/dev/null || true)"
           current_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
-          if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ]; then
+          # A conflicting pull request has no merge ref, so CI never runs on its head: the gate keeps
+          # the carried verdict and resolves the conflict. Pliny-Bot #862 was handed to the gate and
+          # declined every five minutes for an hour waiting for a run that could not start.
+          conflicting="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || true)"
+          if [ -n "$run_sha" ] && [ "$run_sha" != "$current_sha" ] && [ "$conflicting" != CONFLICTING ]; then
             echo "::notice::CI run $ci_run_id judged ${run_sha:0:7}, but the head is ${current_sha:0:7}; reading the verdict again from the head."
             ci_conclusion=""
             ci_run_id=""
@@ -154,6 +158,8 @@ runs:
             fi
             ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$fresh")"
             ci_run_id="$(jq -r '.id' <<<"$fresh")"
+          elif [ "$conflicting" = CONFLICTING ]; then
+            echo "::notice::PR #$PR_NUMBER conflicts with its base, so CI cannot run on its head; the gate resolves the conflict."
           fi
         fi
 

package/loops/actions/merge-train/action.yml

@@ -50,6 +50,10 @@ inputs:
     description: Decide and report the move without making it.
     required: false
     default: 'false'
+  ci-depth-tiered:
+    description: "true when the repository's CI runs only light checks on a bot's push and the full CI when the train asks (repository variable CI_DEPTH_TIERED)."
+    required: false
+    default: 'false'
   ci-run-id:
     description: A CI run that handed its verdict over from inside itself, and so still reads as in progress.
     required: false
@@ -78,6 +82,7 @@ runs:
         MAIN_RED_WAIT_HOURS: ${{ inputs.main-red-wait-hours }}
         MAX_REPAIRS: ${{ inputs.max-repairs }}
         DRY_RUN: ${{ inputs.dry-run }}
+        CI_DEPTH_TIERED: ${{ inputs.ci-depth-tiered }}
         HINT_RUN_ID: ${{ inputs.ci-run-id }}
         HINT_CONCLUSION: ${{ inputs.ci-conclusion }}
       run: bash "${GITHUB_ACTION_PATH}/merge-train.sh"

package/loops/actions/merge-train/merge-train.sh

@@ -70,6 +70,8 @@ train_move() {
           success)
             if [ "${BEHIND_BY:-0}" -gt 0 ]; then
               move=update; reason="green but ${BEHIND_BY} commit(s) behind its base branch"
+            elif [ "${CI_SHALLOW:-false}" = true ]; then
+              move=deepen; reason="green on the light checks only; the full CI has not run on this head"
             else
               move=gate; reason="green and up to date"
             fi
@@ -199,6 +201,32 @@ act() {
   "$@"
 }
 
+# Tiered CI: the label that asks a pull request's CI for the full depth. The CI's depth job reads the
+# pull request's labels at run time, so a re-run of the same pull_request run turns full: the event and
+# its context stay the pull request's, which the scope, mutation and coverage jobs rely on (a separate
+# workflow_dispatch run would lose it, and mutation runs on pull_request events only).
+CI_FULL_LABEL="ci-full"
+
+mark_full_ci() {
+  local pr="$1"
+  gh label create "$CI_FULL_LABEL" --repo "$REPO" --color 0E8A16 \
+    --description "The CI runs at full depth on this pull request (set by the merge train)" >/dev/null 2>&1 || true
+  gh api -X POST "repos/$REPO/issues/$pr/labels" -f "labels[]=$CI_FULL_LABEL" >/dev/null 2>&1
+}
+
+deepen_ci() {
+  local pr="$1" run="$2"
+  [ -n "$run" ] || return 1
+  mark_full_ci "$pr" || return 1
+  # A CI handover reaches the train from inside the run, and a run still going cannot be re-run.
+  local i
+  for i in 1 2 3 4 5 6 7 8 9 10 11 12; do
+    [ "$(gh api "repos/$REPO/actions/runs/$run" --jq .status 2>/dev/null)" = completed ] && break
+    sleep 10
+  done
+  gh run rerun "$run" --repo "$REPO" >/dev/null 2>&1
+}
+
 is_trusted_bot() {
   case " $TRUSTED_BOTS " in *" $1 "*) return 0 ;; esac
   return 1
@@ -435,6 +463,16 @@ for line in "${candidates[@]}"; do
       success | failure) ci_status=completed; ci_conclusion="$HINT_CONCLUSION" ;;
     esac
   fi
+  # Tiered CI (CI_DEPTH_TIERED): a bot's push runs the light checks and the full CI runs once, when the
+  # pull request is next in line. Pliny-Bot spent two thirds of its pull request CI on heads that were
+  # replaced before they merged. A green run without a successful "Full CI" job was light and says
+  # nothing about the tests. When the jobs cannot be read the run is taken as full, as before.
+  ci_shallow=false
+  if [ "${CI_DEPTH_TIERED:-false}" = true ] && [ "$ci_status" = completed ] && [ "$ci_conclusion" = success ] && [ -n "${ci_run_id:-}" ]; then
+    full_jobs=$(gh api "repos/$REPO/actions/runs/$ci_run_id/jobs?per_page=100" \
+      --jq '[.jobs[] | select((.name | test("(^|/ )Full CI$")) and .conclusion == "success")] | length' 2>/dev/null || echo "")
+    [ "$full_jobs" = 0 ] && ci_shallow=true
+  fi
   ci_stuck=false
   if [ "$ci_status" != none ] && [ "$ci_status" != completed ] && [ -n "${ci_created:-}" ]; then
     [ $((now_epoch - $(iso_epoch "$ci_created"))) -lt $((STUCK_HOURS * 3600)) ] || ci_stuck=true
@@ -503,7 +541,7 @@ for line in "${candidates[@]}"; do
   decision=$(HOLD="$hold" REVIEW_DECISION="$review_decision" PARK="$park" \
     ATTEMPTS="$attempts" MAX_ATTEMPTS="$MAX_ATTEMPTS" SILENT_GATE="$silent_gate" MERGEABLE="$mergeable" \
     CI_STATUS="$ci_status" CI_CONCLUSION="$ci_conclusion" CI_STUCK="$ci_stuck" SAME_AS_MAIN="$same_as_main" \
-    BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" train_move)
+    BEHIND_BY="${behind_by:-0}" TRUSTED_AUTHOR="$trusted_author" CI_SHALLOW="$ci_shallow" train_move)
   move=$(sed -n 's/^move=//p' <<<"$decision")
   reason=$(sed -n 's/^reason=//p' <<<"$decision")
 
@@ -544,11 +582,30 @@ for line in "${candidates[@]}"; do
       merge_blocked=true
       continue
       ;;
+    deepen)
+      if [ "$merge_blocked" = true ]; then
+        echo "  #$pr waits for the pull request ahead of it before its full CI runs."
+        continue
+      fi
+      if act "Running the full CI on #$pr, which is next in line." deepen_ci "$pr" "${ci_run_id:-}"; then
+        merge_blocked=true
+        continue
+      fi
+      # Never a gate on the light run: it could merge code no test has run on. The pull request is
+      # skipped this tick and the line moves on, so one that cannot be deepened does not stop the rest.
+      echo "::warning::Could not start the full CI on #$pr; it is skipped this tick."
+      continue
+      ;;
     update)
       if [ "$merge_blocked" = true ]; then
         echo "  #$pr waits for the pull request ahead of it before it is brought up to date."
         continue
       fi
+      # Next in line: with tiered CI the run this update starts is the one that decides, so it runs full.
+      if [ "${CI_DEPTH_TIERED:-false}" = true ]; then
+        act "Asking for the full CI on #$pr before it is brought up to date." mark_full_ci "$pr" ||
+          echo "::warning::Could not label #$pr for the full CI; its update runs the light checks."
+      fi
       # Merge, never rebase: the gate's pushes are fast-forward only, and so are a person's.
       if act "Merging $base_ref into #$pr so CI judges it against what it will land on." \
         update_branch "$pr" "$head_sha"; then

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2863,6 +2863,29 @@ else
   FAIL=$((FAIL + 1))
   echo "FAIL: the gate measures a stack child's comments and tests against the default branch" >&2
 fi
+# Tiered CI: the train deepens a light green run instead of gating it, and never gates a light run.
+if grep -qF 'move=deepen' "${HERE}/../merge-train/merge-train.sh" &&
+  grep -qF 'deepen_ci "$pr" "${ci_run_id:-}"' "${HERE}/../merge-train/merge-train.sh" &&
+  grep -qF "ci-depth-tiered: \${{ vars.CI_DEPTH_TIERED || 'false' }}" "${WORKFLOWS_DIR}/work-router.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge train does not ask for the full CI before gating a light run" >&2
+fi
+# The implement agent tests only what it changed; the repository's CI runs the full suite.
+if grep -qF 'Test only what you changed; CI tests the rest.' "${WORKFLOWS_DIR}/agent-implement.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: implement tests only what it changed is missing from the prompt" >&2
+fi
+# A conflicting pull request is gated on its carried verdict: CI cannot run on a head with no merge ref.
+if grep -qF '[ "$conflicting" != CONFLICTING ]' "${HERE}/../identify-gate-subject/action.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the gate waits for CI on a conflicting pull request, which never gets a run" >&2
+fi
 # An empty AGENT_TIER_MODEL must remove an override a reused runner kept from an earlier job.
 if grep -qF 'rm -f .opencode/harness.user.json' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   PASS=$((PASS + 1))

package/loops/workflows/agent-implement.md

@@ -839,6 +839,16 @@ timeout-minutes: 180
 
      Never open a pull request that does not pass them.
 
+     **Test only what you changed; CI tests the rest.** In this run, run the tests that cover the
+     code you touched and nothing wider: the test files you added or edited, and the tests next to
+     the code you changed (web: `pnpm exec vitest related --run <changed files>`; .NET:
+     `dotnet test <the test project> --filter <the test classes>`). Do not run integration,
+     end-to-end, mutation or coverage suites here, and do not run the whole test suite to be safe:
+     the repository's CI runs all of it on your pull request before anything merges, on a runner
+     that has the database and the browsers this sandbox lacks. The verification commands above are
+     the repository's quick check for that reason. A full suite in the agent is the slowest part of
+     a run and repeats what CI does anyway.
+
      **Run them once, on the final tree.** They are slow: Pliny-Bot's `pnpm verify` is about
      twenty minutes of work on this runner. `pc-plan-apply` runs them in its verify step, and
      that run is this one: do not run them again when nothing changed since. Order the end of

package/loops/workflows/work-router.yml

@@ -938,6 +938,8 @@ jobs:
           dry-run: ${{ env.MERGE_TRAIN_DRY_RUN }}
           ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
           ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
+          # Repository variable, read by the repository's CI as well: one switch for both sides.
+          ci-depth-tiered: ${{ vars.CI_DEPTH_TIERED || 'false' }}
 
   # The decision the gate parked for: a person with write access approves a pull request the
   # gate handed to them (human-review or owner-review), and the bot merges the commit they

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.47",
+  "version": "1.6.48",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",